4.1 - Understand and Support Incident Response Lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)) SSCP Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   Which activity is a key component of the Preparation phase in incident response?

   • AIsolating affected systems
   • BConducting a lessons learned review
   • CEstablishing incident response roles and responsibilities
   • DIdentifying indicators of compromise
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company has detected a worm spreading across its internal network. The incident response team needs to stop the spread while preserving evidence for forensic analysis. Which containment strategy is MOST appropriate?

   • ARebuild all affected systems from known-good images.
   • BIsolate affected network segments by disconnecting them from the rest of the network.
   • CChange all user passwords in the organization.
   • DImmediately shut down all affected servers.
   Reveal Solution Discussion Select an answer first